Hackers Associate is an official platform that provides advanced cybersecurity training with complete hands-on, VAPT services to private & government organization, events & workshops. Being the only organization in India that provides 80+ Cyber Security Training Certifications, we ensure quality education with the pillars of practical instances and real-life case studies.
OAES (Offensive API Exploitation and Security) is an industry-specific program that focuses on offensive exploitation and security of an API. This course is an advanced, hands-on, practical program where each candidate is given a custom VM developed specifically for API penetration testing, and all tools are configured to verify safety defects in modern APIs.
API stands for Application Programming Interface which is widely used on the internet for Web Application, mobile, IoT, desktop applications, and much more as shown in examples above. The modern application uses the API to call or execute the actions or the activities of the user. Customers or service users are exposed to the API architecture or structure.
The REST API uses multiple processing requests such as GET, POST, PUT, DELETE, OPTIONS, PROPFIND etc. This helps the user to understand the API's structure and use this information attack API further. This understanding of API can be used to exploit the API.
WHY HACKER ASSOCIATE
Hacker Associate has launched an industry-specific API Exploitation Program with a completely hands-on course, and advanced CTF (capture the flag) labs are introduced for each candidate. This OAES 308 Certification program will focus on complete API exploitation and defence techniques. We will dive deep in detail into all the standards like SOAP, XML, REST, and GRAPH QL, and best practices.
We will also learn how we can penetrate cloud-based Web API and will go through advanced technique and industry best practices for a modern web application, mobile app, and desktop applications.
OAES Course Highlights
Cloud Based API Exploitation
Authentication and Access Control Bypass
Live Real World API Exploitation
All Injections
OAUTH2.0 Exploitation
IDOR (Insecure Direct Object Reference)
All Server-Side Vulnerabilities
Crypto and Algorithm Attacks
Content Discovery & API Fuzzing
REST, GRAPHQL and SOAP API Exploitation
Resources Access with OAES
Free challenges lab access
Unbounded revision
15 real world case studies
lifelong instructor support
Practice labs before exam
80+ Recorded session video access
Course Delivery
In-Person
Live Instructor Led
OnDemand
Onsite
OAES COURSE SYLLABUS
Module-1- Brief Introduction to API and case study
Module-2- HTTP and HTTPS basics
Module-3- Brief Introduction to TLS/SSL and how encryption work
Module-4- API Standards in Details
Module-5- Lab Setup for Offensive API Penetration Testing
Module-6- Python Lab Setup for API Penetration Testing
Module-7- Modern API Attacks and Countermeasure
Module-8- Securing API and case study
Module-9- Proxy Tools and configuration ( Burpsuite and Fiddler)
Module-10- Exploring Hidden feature of BURP for API Exploitation
Module-11- TOP-20 API Industry based Tools and configuration
Module-12- Fuzzing API using custom scripts
Module-13- Crafting series of attack for API Exploitation
Module-14- API Reconnaissance and Fingerprint
Module-15- REST-API Crafting attacks
Module-16- Brief Introduction to JWT Token
Module-17- Brief Introduction to Session, Cookie & Tokens
Module-18- JWT Token Bypassing Technique
Module-19- Cryptographic Algorithm Attack
Module-20- UBER/GITHUB API Endpoint Analysis
Module-21- Brief Introduction to OAuth 1 and OAuth 2
Module-22- Brief Introduction to OpenID
Module-23- Attack OAuth Token
Module-24- Open REDIRECT Attack
Module-25- XSS and CSRF Attack on OAuth
Module-26- DOS/DDOS Attack on API
Module-27- Implicit Attack Flow
Module-28- Bruteforcing Attack on Token
Module-29- Pure Bruteforcing Attack on API
Module-30- Authentication Bypass
Module-31- IDOR Attacks Flow and Hands-on
Module-32- SQL Injection Identifying on API
Module-33- SQL Injection Attack on API
Module-34- RCE Attack Flow and Hands-on
Module-35- Mitigation of all API Attacks
Module-36- Hash Cracking Technique
Module-37- Public/Private Key Attacking technique
Module-38- OAES Exam Walkthrough
Module-39- OWASP API Exploitation and Security Top 10
Module-40- OAuth2 Client CSRF Attack
Module-41- OAuth2 Authorization Server CSRF
Module-42- CVE-2016-4977( Vulnerable Version of Spring's OAuth)
Prerequisites
Even though the OAES will start from scratch we recommend, a candidate to have fundamental understanding of how Network and Web Applications works.
who is this course for?
OAES will benefit all who want to choose their career as a Penetration Tester, and add API Security and OAuth to their skills.
Software Engineer
Security Expert
Application Developer
Web Developer
Backend Developer
Penetration Tester
Ethical Hacker
System Requirement
CPU: 64-bit Intel i5/i7 with 4th generation + (2.0 GHz)
8 GB of RAM or higher
300 GB free space
Administrator Access
Wi-Fi 802.11 capability
Windows 10 Pro, Linux or macOS (Latest updated)
NOTE: All other software and configuration requirement will be provided and guided.
Course Duration
40 hours live instructor led training with complete hands-on.
Pricing
OAES training + course material + exam certification + lifetime Hacker Associate membership.
